What is the CVSS score of EUVD-2025-201173?

EUVD-2025-201173 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Router Manager are affected by EUVD-2025-201173?

Organizations using A vulnerability in VideoPlayer2 subtitle cgi should be aware of moderate risk from CVE-2025-29845, a path traversal vulnerability rated CVSS 4.3.. A patch is available.

How to fix or mitigate EUVD-2025-201173?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Router Manager EUVD-2025-201173

| CVE-2025-29845 MEDIUM

Path Traversal (CWE-22)

2025-12-04 security@synology.com

Path Traversal Router Manager

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.3.1-9346-13

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201173

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 15:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.

Analysis

A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

More in Router Manager

View all

CVE-2017-5753 MEDIUM This Month POC

5.6 Jan 04

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

CVE-2017-14491 CRITICAL Act Now POC

9.8 Oct 04

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut

CVE-2020-27655 CRITICAL Act Now POC

10.0 Oct 29

Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to acce

CVE-2020-27654 CRITICAL Act Now POC

9.8 Oct 29

Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers

CVE-2018-1160 CRITICAL Act Now POC

9.8 Dec 20

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. Rated critical severity (CVSS 9.8), th

CVE-2020-27649 CRITICAL Act Now POC

9.0 Oct 29

Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allow

CVE-2020-27653 HIGH This Week POC

8.3 Oct 29

Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-m

CVE-2020-27651 HIGH This Week POC

8.1 Oct 29

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session,

CVE-2020-27658 MEDIUM This Month POC

6.1 Oct 29

Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the sessio

CVE-2019-3870 MEDIUM This Month POC

6.1 Apr 09

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. Rated medium severi

CVE-2020-27657 MEDIUM This Month POC

5.9 Oct 29

Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081

CVE-2023-32956 CRITICAL Act Now

9.8 May 16

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in CGI componen

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

CVE-2018-13379 CRITICAL POC

9.1

CVE-2015-0016 HIGH POC

7.8

Same technique Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2015-0016 HIGH POC

7.8

CVE-2016-0752 HIGH POC

7.5

CVE-2024-13159 CRITICAL POC

9.8

CVE-2024-13160 CRITICAL POC

9.8

CVE-2024-13161 CRITICAL POC

9.8

CVE-2014-0780 CRITICAL POC

9.8

CVE-2024-48248 HIGH POC

8.6

EUVD-2025-201173 vulnerability details – vuln.today

Back

Router Manager EUVD-2025-201173

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Router Manager

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Share

External POC / Exploit Code